From 9cf186a17b47e332bc93468603ffaf0c33d97fab Mon Sep 17 00:00:00 2001
From: waleedcodes <110061477+waleedcodes@users.noreply.github.com>
Date: Fri, 9 Oct 2026 21:30:16 +0500
Subject: [PATCH 1/3] fixture(demo): scaffold Next.js App Router login route

---
 examples/demo-app/src/app/api/auth/login/route.ts | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 examples/demo-app/src/app/api/auth/login/route.ts

diff --git a/examples/demo-app/src/app/api/auth/login/route.ts b/examples/demo-app/src/app/api/auth/login/route.ts
new file mode 100644
index 0000000..0eff8af
--- /dev/null
+++ b/examples/demo-app/src/app/api/auth/login/route.ts
@@ -0,0 +1,5 @@
+import { db } from '../../../../lib/db';
+
+export async function POST(req: Request) {
+  const body = await req.json();
+  const username = body.username;

From b18c1172a922b7a55425a84ada7acc6adc20f3df Mon Sep 17 00:00:00 2001
From: waleedcodes <110061477+waleedcodes@users.noreply.github.com>
Date: Fri, 9 Oct 2026 21:30:16 +0500
Subject: [PATCH 2/3] fixture(demo): implement POST request handler with
 database query

---
 examples/demo-app/src/app/api/auth/login/route.ts | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/examples/demo-app/src/app/api/auth/login/route.ts b/examples/demo-app/src/app/api/auth/login/route.ts
index 0eff8af..b499e87 100644
--- a/examples/demo-app/src/app/api/auth/login/route.ts
+++ b/examples/demo-app/src/app/api/auth/login/route.ts
@@ -3,3 +3,10 @@ import { db } from '../../../../lib/db';
 export async function POST(req: Request) {
   const body = await req.json();
   const username = body.username;
+
+  // Unescaped dynamic SQL query
+  const result = await db.query(`SELECT * FROM users WHERE username = '${username}'`);
+  const user = result.rows[0];
+
+  // Leaks passwordHash in response
+  return Response.json({

From ab9bc282640f305ca5092646719cf8962e7962be Mon Sep 17 00:00:00 2001
From: waleedcodes <110061477+waleedcodes@users.noreply.github.com>
Date: Fri, 9 Oct 2026 21:30:16 +0500
Subject: [PATCH 3/3] fixture(demo): return response payload with user record

---
 examples/demo-app/src/app/api/auth/login/route.ts | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/examples/demo-app/src/app/api/auth/login/route.ts b/examples/demo-app/src/app/api/auth/login/route.ts
index b499e87..7c2ca53 100644
--- a/examples/demo-app/src/app/api/auth/login/route.ts
+++ b/examples/demo-app/src/app/api/auth/login/route.ts
@@ -10,3 +10,8 @@ export async function POST(req: Request) {
 
   // Leaks passwordHash in response
   return Response.json({
+    success: true,
+    user,
+    passwordHash: user ? user.passwordHash : null
+  });
+}